From 697a1fc2c5c3da1c2dfc5f7277c42d9909e87111 Mon Sep 17 00:00:00 2001 From: "dotnet-maestro[bot]" Date: Tue, 4 Aug 2026 02:07:47 +0000 Subject: [PATCH 1/6] Backflow from https://github.com/dotnet/dotnet / 322f500 build 325363 Diff: https://github.com/dotnet/dotnet/compare/2ed1bf0ccb2d62d14c6161ac689f3d41b70066e9..322f5005d6589845edf1d69d55820a7d1ab9a09c From: https://github.com/dotnet/dotnet/commit/2ed1bf0ccb2d62d14c6161ac689f3d41b70066e9 To: https://github.com/dotnet/dotnet/commit/322f5005d6589845edf1d69d55820a7d1ab9a09c [[ commit created by automation ]] --- eng/Build.ps1 | 2 +- eng/Versions.props | 4 ++-- eng/build.sh | 3 +++ src/FSharp.Build/FSharp.Build.fsproj | 2 +- src/fsc/fsc.targets | 1 + src/fsi/fsi.targets | 1 + tests/FSharp.Build.UnitTests/FSharp.Build.UnitTests.fsproj | 1 + 7 files changed, 10 insertions(+), 4 deletions(-) diff --git a/eng/Build.ps1 b/eng/Build.ps1 index 41a52df6395..01ff6313626 100644 --- a/eng/Build.ps1 +++ b/eng/Build.ps1 @@ -253,7 +253,7 @@ function Process-Arguments() { } foreach ($property in $properties) { - if (!$property.StartsWith("/p:", "InvariantCultureIgnoreCase")) { + if (!$property.StartsWith("/p:", "InvariantCultureIgnoreCase") -and !$property.StartsWith("/clp:", "InvariantCultureIgnoreCase")) { Write-Host "Invalid argument: $property" Print-Usage exit 1 diff --git a/eng/Versions.props b/eng/Versions.props index 4a024d1ee71..9e92a603816 100644 --- a/eng/Versions.props +++ b/eng/Versions.props @@ -14,8 +14,8 @@ - 7 - preview$(FSharpPreReleaseIteration) + 1 + rc$(FSharpPreReleaseIteration) 11 0 diff --git a/eng/build.sh b/eng/build.sh index 0e63dda50fe..7e0d6dd2a87 100755 --- a/eng/build.sh +++ b/eng/build.sh @@ -194,6 +194,9 @@ while [[ $# > 0 ]]; do /p:*) properties+=("$1") ;; + /clp:*) + properties+=("$1") + ;; *) echo "Invalid argument: $1" usage diff --git a/src/FSharp.Build/FSharp.Build.fsproj b/src/FSharp.Build/FSharp.Build.fsproj index d7f814ce261..09b5043b225 100644 --- a/src/FSharp.Build/FSharp.Build.fsproj +++ b/src/FSharp.Build/FSharp.Build.fsproj @@ -89,7 +89,7 @@ - + diff --git a/src/fsc/fsc.targets b/src/fsc/fsc.targets index c85dc1e66ab..d64ee1a886e 100644 --- a/src/fsc/fsc.targets +++ b/src/fsc/fsc.targets @@ -56,6 +56,7 @@ + diff --git a/src/fsi/fsi.targets b/src/fsi/fsi.targets index cba9355e99f..1cad3f31b04 100644 --- a/src/fsi/fsi.targets +++ b/src/fsi/fsi.targets @@ -68,6 +68,7 @@ + \ No newline at end of file diff --git a/tests/FSharp.Build.UnitTests/FSharp.Build.UnitTests.fsproj b/tests/FSharp.Build.UnitTests/FSharp.Build.UnitTests.fsproj index 08df369bf4a..cf3293fc456 100644 --- a/tests/FSharp.Build.UnitTests/FSharp.Build.UnitTests.fsproj +++ b/tests/FSharp.Build.UnitTests/FSharp.Build.UnitTests.fsproj @@ -32,6 +32,7 @@ + From 8485fe87608c485a042ea4410e1aed7f334664a9 Mon Sep 17 00:00:00 2001 From: "dotnet-maestro[bot]" Date: Tue, 4 Aug 2026 02:08:04 +0000 Subject: [PATCH 2/6] Update dependencies from build 325363 No dependency updates to commit [[ commit created by automation ]] --- eng/Version.Details.xml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/eng/Version.Details.xml b/eng/Version.Details.xml index 0932647c439..080d605c6bc 100644 --- a/eng/Version.Details.xml +++ b/eng/Version.Details.xml @@ -1,6 +1,6 @@ - + https://github.com/dotnet/msbuild From e7ccfa69ddc20c31233715086539024da2ed4399 Mon Sep 17 00:00:00 2001 From: Copilot <223556219+Copilot@users.noreply.github.com> Date: Tue, 4 Aug 2026 11:05:06 +0200 Subject: [PATCH 3/6] Remove duplicate System.Security.Cryptography.Xml PackageReference (fix NU1504) The backflow added the canonical PrivateAssets=all override into the shared fsc.targets/fsi.targets and the FSharp.Build.UnitTests item group, but the earlier codeflow (#20058) had already added a conditional (net-core-only) override directly in fsc.fsproj, fsi.fsproj and FSharp.Build.UnitTests.fsproj. This produced two identical PackageReference items for net11.0, failing restore with NU1504 (WarnAsError) across all CI jobs. Removing the redundant conditional blocks aligns these projects with the VMR (dotnet/dotnet) canonical state; each project now references the package exactly once via the shared item group / .targets import. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --- src/fsc/fscProject/fsc.fsproj | 5 ----- src/fsi/fsiProject/fsi.fsproj | 5 ----- tests/FSharp.Build.UnitTests/FSharp.Build.UnitTests.fsproj | 5 ----- 3 files changed, 15 deletions(-) diff --git a/src/fsc/fscProject/fsc.fsproj b/src/fsc/fscProject/fsc.fsproj index c66429fe0dc..a8d694360c1 100644 --- a/src/fsc/fscProject/fsc.fsproj +++ b/src/fsc/fscProject/fsc.fsproj @@ -37,11 +37,6 @@ - - - - - diff --git a/src/fsi/fsiProject/fsi.fsproj b/src/fsi/fsiProject/fsi.fsproj index 7a0e2d01428..58a300a0de9 100644 --- a/src/fsi/fsiProject/fsi.fsproj +++ b/src/fsi/fsiProject/fsi.fsproj @@ -25,11 +25,6 @@ $(ArtifactsDir)obj/$(MSBuildProjectName)/$(Configuration)/ - - - - - diff --git a/tests/FSharp.Build.UnitTests/FSharp.Build.UnitTests.fsproj b/tests/FSharp.Build.UnitTests/FSharp.Build.UnitTests.fsproj index cf3293fc456..c74f5e4c0f6 100644 --- a/tests/FSharp.Build.UnitTests/FSharp.Build.UnitTests.fsproj +++ b/tests/FSharp.Build.UnitTests/FSharp.Build.UnitTests.fsproj @@ -35,9 +35,4 @@ - - - - - From 65d91b1cad59ba486caaf678cb34596ef0f2e7ef Mon Sep 17 00:00:00 2001 From: Copilot <223556219+Copilot@users.noreply.github.com> Date: Tue, 4 Aug 2026 12:42:48 +0200 Subject: [PATCH 4/6] Pin transitive MessagePack in CLaSP Proxy project (fix NU1902/NU1903) The Microsoft.CommonLanguageServerProtocol.Framework.Proxy project pulls MessagePack 2.5.108 transitively via Microsoft.CommonLanguageServerProtocol.Framework. That version has known moderate/high severity vulnerabilities, so NuGetAudit (WarnAsError) failed restore/build with NU1902/NU1903 on every Windows CI job that builds VisualFSharp.slnx. Pin MessagePack to the patched 2.5.302, mirroring the existing pin already present in the sibling FSharp.Compiler.LanguageServer.fsproj. PrivateAssets="all" keeps the dependency private to match the wrapped framework reference. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --- ...icrosoft.CommonLanguageServerProtocol.Framework.Proxy.csproj | 2 ++ 1 file changed, 2 insertions(+) diff --git a/src/Microsoft.CommonLanguageServerProtocol.Framework.Proxy/Microsoft.CommonLanguageServerProtocol.Framework.Proxy.csproj b/src/Microsoft.CommonLanguageServerProtocol.Framework.Proxy/Microsoft.CommonLanguageServerProtocol.Framework.Proxy.csproj index 97ac5ccaebe..a50a29c6f91 100644 --- a/src/Microsoft.CommonLanguageServerProtocol.Framework.Proxy/Microsoft.CommonLanguageServerProtocol.Framework.Proxy.csproj +++ b/src/Microsoft.CommonLanguageServerProtocol.Framework.Proxy/Microsoft.CommonLanguageServerProtocol.Framework.Proxy.csproj @@ -9,6 +9,8 @@ + + From 575ff1091d95ccb3363eab4bdeaba49af632c082 Mon Sep 17 00:00:00 2001 From: Copilot Date: Tue, 4 Aug 2026 14:05:58 +0200 Subject: [PATCH 5/6] Fix duplicate PackageReference in CLaSP Proxy under CPM (NU1504/NU1008) The codeflow merge of 'Implement direct delegates' combined the pre-CPM proxy csproj (with Version= attributes plus the MessagePack security pin) with the CPM-compatible version from main, producing duplicate PackageReference items. Under Central Package Management this caused NU1504 (duplicate items) and NU1008 (Version not allowed on PackageReference). Dedupe to the CPM-compatible form: drop the Version= attributes, keep the MessagePack pin (central PackageVersion is already 2.5.302, preserving the NU1902/NU1903 fix) and the Microsoft.VisualStudio.Threading VersionOverride. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --- ...soft.CommonLanguageServerProtocol.Framework.Proxy.csproj | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) diff --git a/src/Microsoft.CommonLanguageServerProtocol.Framework.Proxy/Microsoft.CommonLanguageServerProtocol.Framework.Proxy.csproj b/src/Microsoft.CommonLanguageServerProtocol.Framework.Proxy/Microsoft.CommonLanguageServerProtocol.Framework.Proxy.csproj index a38c4c2cd47..2eaa653e8b6 100644 --- a/src/Microsoft.CommonLanguageServerProtocol.Framework.Proxy/Microsoft.CommonLanguageServerProtocol.Framework.Proxy.csproj +++ b/src/Microsoft.CommonLanguageServerProtocol.Framework.Proxy/Microsoft.CommonLanguageServerProtocol.Framework.Proxy.csproj @@ -7,11 +7,9 @@ - - - - + + From b537a45a38aae7e7a47947e5f9dfd34b8c35a275 Mon Sep 17 00:00:00 2001 From: Copilot Date: Tue, 4 Aug 2026 16:55:37 +0200 Subject: [PATCH 6/6] Restore pull-requests: write for release-notes check comment step PR #20081 (Secure release-note checks for fork pull requests) downgraded the check_release_notes workflow permissions from 'pull-requests: write' to 'pull-requests: read' while keeping 'issues: write'. Commenting on a pull request via GitHub Actions requires 'pull-requests: write' (issues: write alone is insufficient for PR conversation comments), so the final 'Create or update comment' step began failing with 'Resource not accessible by integration' (HTTP 403). PR #20135 is the first codeflow PR to run the new workflow and surfaced the regression. Restore 'pull-requests: write' at both workflow and job level while keeping the rest of the #20081 hardening (contents: read, explicit env, stale-head guards). Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --- .github/workflows/check_release_notes.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/check_release_notes.yml b/.github/workflows/check_release_notes.yml index 34a19b198c5..34d82fd4b89 100644 --- a/.github/workflows/check_release_notes.yml +++ b/.github/workflows/check_release_notes.yml @@ -8,7 +8,7 @@ on: permissions: contents: read issues: write - pull-requests: read + pull-requests: write concurrency: group: release-notes-${{ github.event.pull_request.number }} cancel-in-progress: true @@ -17,7 +17,7 @@ jobs: permissions: contents: read issues: write - pull-requests: read + pull-requests: write env: GH_TOKEN: ${{ github.token }} PR_AUTHOR: ${{ github.event.pull_request.user.login }}